openvpn: upgrade 2.7.0 -> 2.7.5

Upgrade openvpn from 2.7.0 to 2.7.5. Changes: * Drop 0001-tests-skip-test-execution-when-cross-compiling.patch This release already guards the auth-pam unit test TESTS assignment with "if !CROSS_COMPILING" in tests/unit_tests/plugins/auth-pam/Makefile.am * Drop CVE-2026-40215.patch - fixed upstream in 2.7.2. * Drop CVE-2026-13117.patch - fixed upstream in 2.7.5. Security fixes included in this upgrade: Fixed in 2.7.2: * CVE-2026-40215: race condition in TLS handshake that could leak packet data from a previous handshake * CVE-2026-35058: server ASSERT() on a malformed packet with a valid tls-crypt-v2 key Fixed in 2.7.5: * CVE-2026-13379: openvpnserv (Windows) DNS SearchList state pollution * CVE-2026-12996: use-after-free in ack_write_buf() * CVE-2026-13117: use-after-free in tls_wrap_reneg() * CVE-2026-13122: server crash on malformed auth-token * CVE-2026-12932: memory leak in tls-crypt-v2 client key handling * CVE-2026-11771: 1-byte buffer overrun on NTLMv2 proxy responses * CVE-2026-13698: memory leak on tls-crypt-v2 packets Release notes: https://github.com/openvpn/openvpn/releases Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> Signed-off-by: Omkar Patil <OmkarAbaji.Patil@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-10-15 18:27:12 +00:00 · 2026-10-05 14:40:36 +05:30
1 parent b1740f6665
commit 4ee9312479
@@ -1,34 +0,0 @@
-From 93f7f6ca0c916427d28610d3e263fa556587532d Mon Sep 17 00:00:00 2001
-From: Haixiao Yan <haixiao.yan.cn@windriver.com>
-Date: Thu, 26 Mar 2026 13:43:50 +0800
-Subject: [PATCH] tests: skip test execution when cross-compiling
-
-The auth-pam unit test Makefile.am unconditionally assigns the TESTS variable,
-causing test execution to fail during cross-compilation because the target
-binaries are not executable on the build host.
-
-Upstream-Status: Pending
-
-Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com>
---
- tests/unit_tests/plugins/auth-pam/Makefile.am | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/tests/unit_tests/plugins/auth-pam/Makefile.am b/tests/unit_tests/plugins/auth-pam/Makefile.am
-index ba32013ac920..7da299ccde92 100644
--- a/tests/unit_tests/plugins/auth-pam/Makefile.am
-+++ b/tests/unit_tests/plugins/auth-pam/Makefile.am
-@@ -4,8 +4,10 @@ AM_TESTSUITE_SUMMARY_HEADER = ' for $(PACKAGE_STRING) auth_pam Plugin Unit-Tests
- 
- if ENABLE_PLUGIN_AUTH_PAM
- check_PROGRAMS = auth_pam_testdriver
-+if !CROSS_COMPILING
- TESTS = $(check_PROGRAMS)
- endif
-+endif
- 
- auth_pam_testdriver_SOURCES = test_search_and_replace.c  $(top_srcdir)/src/plugins/auth-pam/utils.h $(top_srcdir)/src/plugins/auth-pam/utils.c
- auth_pam_testdriver_CFLAGS  = @TEST_CFLAGS@ -I$(top_srcdir)/src/plugins/auth-pam
-- 
-2.43.0
-
@@ -1,46 +0,0 @@
-From 3ce0242e68527fd1e8d378aecb57c466e8058b44 Mon Sep 17 00:00:00 2001
-From: Max Fillinger <maximilian.fillinger@sentyron.com>
-Date: Fri, 22 May 2026 14:34:57 +0200
-Subject: [PATCH] Fix tls_wrap_reneg use after free
-
-When dynamic tls-crypt is active, it is possible for tls_multi_process
-to set to_link to session->tls_wrap_reneg.work and later free that
-session, leaving to_link.data pointing to freed memory.
-
-This is not caught by the function check_session_buf_not_used because it
-checks only tls_wrap, not tls_wrap_reneg. This commit adds that check.
-
-CVE: 2026-13117
-Github: OpenVPN/openvpn-private-issues#119
-Github: OpenVPN/openvpn-private-issues#125
-Reported-By: Trace37 Labs (https://github.com/trace37labs)
-Github: OpenVPN/openvpn-private-issues#131
-Reported-By: Haiyang Huang <huanghaiyang83@gmail.com>
-Signed-off-by: Max Fillinger <maximilian.fillinger@sentyron.com>
-Acked-By: Arne Schwabe <arne@rfc2549.org>
-(cherry picked from commit 2745768d6181c1d54ebfc5ef81f924a127f4f015)
-
-CVE: CVE-2026-13117
-Upstream-Status: Backport [https://github.com/OpenVPN/openvpn/commit/3ce0242e68527fd1e8d378aecb57c466e8058b44]
-Signed-off-by: Omkar Patil <OmkarAbaji.Patil@windriver.com>
---
- src/openvpn/ssl.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
-index c0ab6d3dfbe..d7e93bd41ab 100644
--- a/src/openvpn/ssl.c
-+++ b/src/openvpn/ssl.c
-@@ -3154,6 +3154,12 @@ check_session_buf_not_used(struct buffer *to_link, struct tls_session *session)
-                     "still in use (tls_wrap.work.data)");
-         goto used;
-     }
-+    if (session->tls_wrap_reneg.work.data == dataptr)
-+    {
-+        msg(M_INFO, "Warning buffer of freed TLS session is "
-+                    "still in use (tls_wrap_reneg.work.data)");
-+        goto used;
-+    }
- 
-     for (int i = 0; i < KS_SIZE; i++)
-     {
@@ -1,59 +0,0 @@
-From 4a2c827c2536aa03a1d6c7cc916689a46c067187 Mon Sep 17 00:00:00 2001
-From: Arne Schwabe <arne@rfc2549.org>
-Date: Fri, 10 Apr 2026 16:59:53 +0200
-Subject: [PATCH] Ensure that buffer of freed session are not used
-
-In a race condition an old TLS session could still try to send a packet but
-also get replaced by a new session. In this case, the buffer of the new
-session is still referenced. Add the check_session_buf_not_used function
-to mitigate this problem.
-
-Also make the check if the to_link pointer is in one of the memory
-regions a bit better even though this not make a difference with the
-way we use these structs. But better safe than sorry.
-
-A better solution to remove the TM_INITIAL state and handle reconnecting
-session in their own complete tls_multi is a more involved fix that requires
-a lot more refactoring.
-
-CVE: 2026-40215
-Reported-By: XlabAI Team of Tencent Xuanwu Lab (xlabai@tencent.com)
-Reported-By: Guannan Wang (wgnbuaa@gmail.com
-Reported-By: Zhanpeng Liu (pkugenuine@gmail.com)
-Reported-By: Guancheng Li (lgcpku@gmail.com)
-Signed-off-by: Arne Schwabe <arne@rfc2549.org>
-
-Change-Id: I7c5fa2a7a2563b7a8955d386411f3ceffe5b092f
-Private-URL: https://github.com/OpenVPN/openvpn-private-issues/issues/112
-Acked-by: Gert Doering <gert@greenie.muc.de>
-
-CVE: CVE-2026-40215
-Upstream-Status: Backport [https://github.com/OpenVPN/openvpn/commit/4a2c827c2536aa03a1d6c7cc916689a46c067187]
-
-Signed-off-by: Gert Doering <gert@greenie.muc.de>
-(cherry picked from commit b2a15fb84d85790eeae4a2e12b431cbfd0b0302f)
-Signed-off-by: Omkar Patil <OmkarAbaji.Patil@windriver.com>
---
- src/openvpn/ssl.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
-index b188b4e9b32..a63d142ec46 100644
--- a/src/openvpn/ssl.c
-+++ b/src/openvpn/ssl.c
-@@ -3280,6 +3280,7 @@ tls_multi_process(struct tls_multi *multi, struct buffer *to_link,
-                 if (i == TM_ACTIVE && ks_lame->state >= S_GENERATED_KEYS
-                     && !multi->opt.single_session)
-                 {
-+                    check_session_buf_not_used(to_link, session);
-                     move_session(multi, TM_LAME_DUCK, TM_ACTIVE, true);
-                 }
-                 else
-@@ -3353,6 +3354,7 @@ tls_multi_process(struct tls_multi *multi, struct buffer *to_link,
-      */
-     if (TLS_AUTHENTICATED(multi, &multi->session[TM_INITIAL].key[KS_PRIMARY]))
-     {
-+        check_session_buf_not_used(to_link, &multi->session[TM_ACTIVE]);
-         move_session(multi, TM_ACTIVE, TM_INITIAL, true);
-         tas = tls_authentication_status(multi);
-         msg(D_TLS_DEBUG_LOW,
@@ -9,16 +9,13 @@ inherit autotools systemd update-rc.d pkgconfig ptest

 SRC_URI = "http://swupdate.openvpn.org/community/releases/${BP}.tar.gz \
           file://0001-configure.ac-eliminate-build-path-from-openvpn-versi.patch \
-           file://0001-tests-skip-test-execution-when-cross-compiling.patch \
           file://openvpn \
           file://run-ptest \
-           file://CVE-2026-40215.patch \
-           file://CVE-2026-13117.patch \
          "

 UPSTREAM_CHECK_URI = "https://openvpn.net/community-downloads"

-SRC_URI[sha256sum] = "2f0e10eb272be61e8fb25fe1cfa20875ff30ac857ef1418000c02290bd6dfa45"
+SRC_URI[sha256sum] = "c6864b3c7d4e059c7d6ce22d1b5fa646c8b379a06af872eeb9792b6083a44ac4"

 CVE_STATUS[CVE-2020-27569] = "not-applicable-config: Applies only Aviatrix OpenVPN client, not openvpn"